CVE Intelligence
Analysis AI-assisted

CVE-2026-23796: Opensolution Quick.Cart Session Fixation (CWE-384)

Opensolution Quick.Cart is affected by session fixation (CWE-384): the session identifier can be set before authentication and stays the same after login, which can let an attacker hijack an authenticated session. The CNA CERT.PL reports that only version 6.7 was tested and confirmed vulnerable, and the vendor did not provide a vulnerable version range. NVD scores the issue 9.8 under CVSS 3.1, while CERT.PL scores it 4.8 under CVSS 4.0.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Opensolution Quick.Cart is affected by session fixation, classified as CWE-384. According to the record, the session identifier can be set before authentication and does not change after the user logs in. The CNA CERT.PL published a third-party advisory at cert.pl.

Impact

  • An attacker who can place a chosen session identifier into a victim's browser may be able to reuse it once the victim authenticates.
  • NVD assigns a CVSS 3.1 base score of 9.8 with a network attack vector and no privileges or user interaction required, as shown in the NVD entry.
  • CERT.PL assigns a CVSS 4.0 score of 4.8 according to the record. The CVSS 4.0 vector is not included in the available data.

Affected products and versions

  • Product listed in the record: Opensolution Quick.Cart.
  • Confirmed vulnerable: version 6.7.
  • Other versions were not tested. The vendor did not provide the vulnerable version range, so other versions may also be affected.
  • The vendor product page is listed as a reference.

Exploitation status

CISA KEV does not list this CVE. No confirmed exploitation in the wild appears in the sources consulted. The record does not indicate whether public exploit code exists, so that status is unknown.

Remediation and mitigation

  • The record does not list any fixed version. This does not prove that no fix exists; check the vendor product page and contact the vendor for an update.
  • Inventory all Quick.Cart installations and identify which ones run version 6.7 or other older releases.
  • Until a vendor fix is confirmed, ask the developer or administrator to review how session identifiers are issued and renewed around login, so that a new session identifier is generated after authentication. This is standard defensive practice and is an inference, since the sources do not describe a specific fix.
  • Limit exposure of administrative and customer account areas where possible.

Detection guidance

  • Review application and web server logs for session identifiers that remain unchanged across login events.
  • Monitor for the same session identifier appearing from unexpected IP addresses or client environments after an authenticated login.

Limitations of the available information

  • No fixed version is listed in the record.
  • Only version 6.7 was tested; the full affected range is unknown.
  • The vendor did not provide details to the CNA.
  • No EPSS score, SSVC data or CVSS 4.0 vector is available in the record.
  • No public proof-of-concept or exploitation evidence was found in the sources consulted.

Frequently asked questions

Is Quick.Cart affected by this vulnerability?

The record confirms that version 6.7 was tested and found vulnerable. Other versions were not tested, so their status is unknown and they may also be affected.

Is there a fixed version available?

The record does not list any fixed version. This does not prove that no fix exists, so check the vendor page and contact the vendor for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.